Live › vulnerability › CVE-2026-98758
Go to dashboardIn the Linux kernel's UCSI USB Type-C driver for Qualcomm pmic_glink, queued work can run after the connector state has been freed during device removal. The sources describe this as a use-after-free that can touch freed memory, and do not state a demonstrated code execution path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems running a Linux kernel with the Qualcomm pmic_glink UCSI Type-C driver are in scope, typically Qualcomm-based ARM devices and laptops. Servers and x86 machines without this hardware driver loaded are unlikely to be affected. The sources do not say which distributions or device families ship the affected code.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel build listed by your distribution's advisory.ucsi_glink or pmic_glink_ucsi driver is loaded with lsmod | grep -i ucsi.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time.
Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered.
This issue was found by an in-house static analysis tool.
This page as .md · .json · in your agent: get_signal("CVE-2026-98758")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.